What you'll learn
Cyber security is about protecting data, devices and networks from threats. This overview covers the security content of CIE IGCSE Computer Science (0478): the main cyber security threats — brute-force attacks, data interception, distributed denial of service (DDoS) attacks, hacking, malware (viruses, worms, Trojan horses, spyware, adware and ransomware), pharming, phishing and social engineering — and the solutions used to keep data safe: access levels, anti-malware, authentication (passwords, biometrics, two-step verification), automating software updates, checking the spelling and tone of communications and URLs, firewalls, privacy settings, proxy servers and secure socket layer (SSL). It also covers why data can be lost accidentally and how backups help.
Questions in this area typically give a threat and ask you to describe it, explain its impact and suggest solutions — or describe a security method and explain how it protects data. The skill is matching threats to solutions and explaining how each solution works.
Key terms and definitions
Brute-force attack — Trying every possible combination of characters until the correct password is found.
Data interception — Stealing data by tapping into a network, for example using a packet sniffer.
DDoS (distributed denial of service) — Many computers, often a botnet, flood a server with requests so it cannot respond to genuine users.
Hacking — Gaining unauthorised access to a computer system.
Malware — Malicious software designed to harm a computer or steal data.
Adware — Software that displays unwanted adverts and may redirect the browser.
Pharming — Malicious code redirects a user from a genuine website to a fake one, even when the correct address is typed.
Phishing — Sending legitimate-looking emails that trick users into revealing personal details or clicking a malicious link.
Social engineering — Manipulating people into breaking normal security procedures.
Firewall — Monitors traffic between a computer or network and the internet and blocks traffic that breaks set rules.
Proxy server — A server that acts as an intermediary between a user and the internet, hiding the user's IP address and filtering traffic.
SSL (secure socket layer) — A protocol that encrypts data sent between a browser and a web server.
Two-step verification — Requiring two separate forms of authentication, such as a password and a code sent to a phone.
Core concepts
Why data needs protecting
Data can be lost, stolen, damaged or altered. Consequences include financial loss, identity theft, legal penalties for organisations that fail to protect personal data, damage to reputation and disruption of services. Data can also be lost accidentally — by deleting files, hardware failure, power cuts or physical damage such as fire — which is why regular backups are part of security.
Brute-force attacks
Attackers use software to try every possible password, often starting with common passwords and dictionary words. The aim is to gain access to an account. Defences: long, complex passwords greatly increase the number of possible combinations; limiting the number of login attempts stops automated guessing; two-step verification means a guessed password is not enough.
Data interception
Data travelling across a network, especially an unsecured wireless network, can be intercepted with a packet sniffer. The attacker can then read usernames, passwords and personal data. Defences: encryption (so intercepted data is unreadable), using HTTPS/SSL websites, and avoiding unsecured public Wi-Fi or using a VPN.
DDoS attacks
A DDoS attack uses many devices — often a botnet of computers infected with malware — to send huge numbers of requests to a web server. The server is overwhelmed and genuine users cannot access it. The aim is disruption, not usually data theft. Defences: firewalls and proxy servers that detect and block unusual traffic, anti-malware to stop devices joining botnets, and specialist filtering services.
Hacking
Hacking means gaining unauthorised access to a system. A malicious hacker may steal, delete or change data or install malware. (Ethical hacking is authorised testing to find weaknesses.) Defences: firewalls, strong passwords, access levels, two-step verification and keeping software updated.
Malware
- Virus — a program that replicates itself and attaches to files; it needs a host file and is often activated when that file is opened. It can delete or corrupt data.
- Worm — a standalone program that replicates itself and spreads across networks without user action, using up bandwidth.
- Trojan horse — malware disguised as legitimate software; once installed it can open a back door, steal data or install other malware.
- Spyware — records user activity, such as keystrokes, and sends it to a third party; used to steal passwords and bank details.
- Adware — displays unwanted adverts and may redirect searches, slowing the device; some adware also gathers data.
- Ransomware — encrypts the user's data and demands payment for the key.
Defences: anti-malware software that scans files and removes threats and is updated regularly; not opening attachments or downloading software from unknown sources; firewalls; automatic updates; and backups to recover from ransomware.
Pharming
Pharming installs malicious code on the user's computer or corrupts a DNS server, so that even when the user types the correct URL they are redirected to a fake website that collects their details. Defences: anti-malware to detect the code, checking that the site uses HTTPS and the URL is correct, and keeping DNS and software secure.
Phishing
Phishing emails appear to come from a trusted organisation, such as a bank, and ask the recipient to click a link or reply with personal details. The link usually leads to a fake website. Defences: user awareness — checking the sender's address, the spelling and tone of the message and the real destination of links; email filtering to block suspicious messages; never giving personal details in response to an unexpected email.
Social engineering
Attackers exploit trust, fear, curiosity or urgency. Examples include phoning a user and pretending to be IT support, leaving infected USB sticks where people will find and use them, and sending messages that create panic. The main defence is training people to follow security procedures and to verify unexpected requests.
Keeping data safe: the solutions
Access levels. Users are given permission only to the data and functions they need. A teacher may see their students' grades but not staff salaries; a student may read but not edit a timetable. This limits the damage if an account is misused.
Anti-malware. Includes antivirus and anti-spyware programs. They scan files and memory, compare them with a database of known threats, quarantine or delete threats, and monitor for suspicious behaviour. They must be kept updated.
Authentication. Confirms a user's identity:
- Passwords — should be strong (long, mixed characters, not personal information) and changed if compromised.
- Biometrics — fingerprint, face, iris or voice recognition; unique to each person and cannot be forgotten, but data cannot be changed if stolen and may be affected by injury.
- Two-step verification — after entering a password, the user enters a code sent to a separate device, so a stolen password alone is not enough.
Automating software updates. Updates often fix security vulnerabilities; setting them to install automatically means they are not forgotten.
Checking spelling and tone of communications and URLs. Phishing emails often contain errors, generic greetings, urgent demands, or URLs that are slightly misspelt versions of genuine ones.
Firewalls. Can be hardware or software. A firewall examines traffic between the computer or network and the internet against a set of rules, blocking unauthorised access and suspicious traffic, and can block access to certain websites. It can log traffic and alert the user.
Privacy settings. On social media and websites, they control who can see personal information and posts, reducing the information available to criminals.
Proxy servers. Sit between the user's computer and the internet. Requests go to the proxy, which forwards them; the website sees the proxy's IP address, not the user's. Proxies can filter content, block access to certain sites, cache frequently used pages to speed up access, and help protect the network from attacks.
SSL. Encrypts data between the browser and the web server. The browser requests the server's digital certificate, checks it is valid, and an encrypted connection is established. Websites using SSL/TLS show https and a padlock in the address bar.
Layered security in practice
Organisations combine several solutions because each protects against different threats. A school, for example, might use a firewall and proxy server to filter internet traffic, anti-malware on every computer with automatic updates, access levels so that students cannot see staff files, strong passwords with two-step verification for staff email, SSL on its online payment system for trips, privacy settings on its social media accounts, regular backups stored separately, and staff training to recognise phishing. If one layer fails, another may still stop the attack — a useful point to make in extended answers.
Worked examples
Example 1: Phishing versus pharming
Explain the difference between phishing and pharming. (2 marks)
Answer: Phishing uses emails that trick the user into clicking a link to a fake website (1). Pharming uses malicious code to redirect the user to a fake website even when they type the correct address (1).
Example 2: Proxy servers
Describe two ways a proxy server helps protect a network. (2 marks)
Answer: It hides the user's IP address from websites, because requests appear to come from the proxy (1). It can filter traffic and block access to harmful websites (1).
Example 3: Matching solutions
A company's staff use weak passwords and several accounts have been accessed by attackers trying thousands of passwords. Identify the attack and suggest two solutions. (3 marks)
Answer: A brute-force attack (1). Require long, complex passwords (1). Use two-step verification so a guessed password is not enough to log in (1).
Example 4: How SSL works
Describe how SSL protects data when a user buys something online.
Answer: The browser requests the website's digital certificate and checks that it is valid. An encrypted connection is then set up, so the payment details sent between the browser and the server are encrypted and cannot be understood if intercepted.
Common mistakes and how to avoid them
- Mixing up viruses and worms. Viruses need a host file; worms spread by themselves.
- Saying a firewall removes malware. It filters traffic; anti-malware removes malware.
- Confusing phishing and pharming.
- Describing a solution without explaining how it works. Say what it does and why that protects the data.
- Forgetting accidental data loss and the role of backups.
Exam technique for "Security"
- For each threat, give what it is, its aim, its effect and a matching solution.
- For each solution, explain how it works, not just its name.
- In scenario questions, quote details from the question and recommend measures that fit them.
Quick revision summary
- Threats: brute force, data interception, DDoS, hacking, malware (virus, worm, Trojan, spyware, adware, ransomware), pharming, phishing, social engineering.
- Solutions: access levels, anti-malware, authentication (passwords, biometrics, two-step verification), automatic updates, checking spelling, tone and URLs, firewalls, privacy settings, proxy servers, SSL.
- Back up data to protect against accidental loss and ransomware.